# CVEs published 2024-10-29

207 CVEs were published on October 29, 2024: 32 critical, 92 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-50348](https://cve.now/CVE-2024-50348.md): InstantCMS has a Cross Site Scripting Vulnerability (CVSS 5.4, instantsoft icms2)
- [CVE-2024-10488](https://cve.now/CVE-2024-10488.md): Use after free in WebRTC in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2024-10487](https://cve.now/CVE-2024-10487.md): Out of bounds write in Dawn in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memory access via a c (CVSS 8.8, Google Chrome)
- [CVE-2024-7992](https://cve.now/CVE-2024-7992.md): Autodesk AutoCAD DWG Stack-Based Buffer Overflow Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +3)
- [CVE-2024-7991](https://cve.now/CVE-2024-7991.md): Autodesk AutoCAD DWG Out-of-Bounds Write Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +3)
- [CVE-2024-9997](https://cve.now/CVE-2024-9997.md): Autodesk AutoCAD DWG File Parsing Memory Corruption Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +3)
- [CVE-2024-9996](https://cve.now/CVE-2024-9996.md): Autodesk AutoCAD DWG File Parsing Out-Of-Bounds Write Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +3)
- [CVE-2024-9489](https://cve.now/CVE-2024-9489.md): Autodesk AutoCAD DWG File Parsing Memory Corruption Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +3)
- [CVE-2024-8896](https://cve.now/CVE-2024-8896.md): Autodesk AutoCAD DXF File Parsing Unitialized Variable Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +3)
- [CVE-2024-8592](https://cve.now/CVE-2024-8592.md): Autodesk AutoCAD CATPART File Parsing Memory Corruption Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-50421](https://cve.now/CVE-2024-50421.md): WordPress PDF Invoices & Packing Slips for WooCommerce plugin \<= 3.8.6 - Broken Access Control vulnerability (CVSS 5.3, WP Overnight WooCommerce PDF Invoices & Packing Slips)
- [CVE-2024-50422](https://cve.now/CVE-2024-50422.md): WordPress Breeze plugin \<= 2.1.14 - Broken Access Control vulnerability (CVSS 5.3, Cloudways Breeze)
- [CVE-2024-50423](https://cve.now/CVE-2024-50423.md): WordPress Templately plugin \<= 3.1.5 - Broken Access Control vulnerability (CVSS 5.4, WPDeveloper Templately)
- [CVE-2024-50424](https://cve.now/CVE-2024-50424.md): WordPress Templately plugin \<= 3.1.5 - Broken Access Control vulnerability (CVSS 6.5, WPDeveloper Templately)
- [CVE-2024-50425](https://cve.now/CVE-2024-50425.md): WordPress WP Booking System – Booking Calendar plugin \<= 2.0.19.10 - Broken Access Control vulnerability (CVSS 6.5, Roland Murg WP Booking System)
- [CVE-2024-10228](https://cve.now/CVE-2024-10228.md): Vagrant VMWare Utility installation files vulnerable to modification by unprivileged user (CVSS 3.8, HashiCorp Vagrant)
- [CVE-2024-9827](https://cve.now/CVE-2024-9827.md): Autodesk AutoCAD ACTranslators CATPART File Parsing Out-Of-Bounds Read Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-9826](https://cve.now/CVE-2024-9826.md): Autodesk AutoCAD ACTranslators 3DM File Parsing Use-After-Free Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-8600](https://cve.now/CVE-2024-8600.md): A maliciously crafted SLDPRT file when parsed in odxsw\_dll.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-8599](https://cve.now/CVE-2024-8599.md): Autodesk AutoCAD ACTranslators STP File Parsing Memory Corruption Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-8598](https://cve.now/CVE-2024-8598.md): Autodesk AutoCAD ACTranslators STEP File Parsing Memory Corruption Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-8597](https://cve.now/CVE-2024-8597.md): Autodesk AutoCAD STEP File Parsing Memory Corruption Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-8596](https://cve.now/CVE-2024-8596.md): Autodesk AutoCAD MODEL File Parsing Out-Of-Bounds Write Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-50428](https://cve.now/CVE-2024-50428.md): WordPress Multi Step Form plugin \<= 1.7.21 - Broken Access Control vulnerability (CVSS 4.3, mondula2016 Multi Step Form)
- [CVE-2024-8595](https://cve.now/CVE-2024-8595.md): Autodesk AutoCAD MODEL File Parsing Use-After-Free Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-8594](https://cve.now/CVE-2024-8594.md): Autodesk AutoCAD MODEL File Parsing Heap-based Buffer Overflow Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-8593](https://cve.now/CVE-2024-8593.md): Autodesk AutoCAD CATPART File Parsing Out-Of-Bounds Write Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-8591](https://cve.now/CVE-2024-8591.md): Autodesk AutoCAD 3DM File Parsing Heap-based Buffer Overflow Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-50454](https://cve.now/CVE-2024-50454.md): WordPress SEOPress plugin \<= 8.1.1 - Unauthenticated Broken Access Control vulnerability (CVSS 5.3, Benjamin Denis SEOPress)
- [CVE-2024-8590](https://cve.now/CVE-2024-8590.md): Autodesk AutoCAD 3DM File Parsing Use-After-Free Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-8589](https://cve.now/CVE-2024-8589.md): Autodesk AutoCAD SLDPRT File Parsing Out-Of-Bounds Read Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-8588](https://cve.now/CVE-2024-8588.md): Autodesk AutoCAD SLDPRT File Parsing Out-Of-Bounds Read Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-8587](https://cve.now/CVE-2024-8587.md): Autodesk AutoCAD SLDPRT File Parsing Heap-based Buffer Overflow Code Execution Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-50455](https://cve.now/CVE-2024-50455.md): WordPress SEOPress plugin \<= 8.1.1 - Broken Access Control vulnerability (CVSS 4.3, Benjamin Denis SEOPress)
- [CVE-2024-50456](https://cve.now/CVE-2024-50456.md): WordPress SEOPress plugin \<= 8.1.1 - Broken Access Control vulnerability (CVSS 5.4, Benjamin Denis SEOPress)
- [CVE-2024-50459](https://cve.now/CVE-2024-50459.md): WordPress AidWP plugin \<= 3.2.3 - Broken Access Control vulnerability (CVSS 5.3, Hossni Mubarak AidWP)
- [CVE-2024-50466](https://cve.now/CVE-2024-50466.md): WordPress DarkMySite – Advanced Dark Mode Plugin for WordPress plugin \<= 1.2.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, DarkMySite – Advanced Dark Mode Plugin for WordPress)
- [CVE-2024-9989](https://cve.now/CVE-2024-9989.md): Crypto \<= 2.18 - Authentication Bypass via log\_in (CVSS 9.8, odude Crypto Tool)
- [CVE-2024-9990](https://cve.now/CVE-2024-9990.md): Crypto \<= 2.15 - Cross-Site Request Forgery to Authentication Bypass (CVSS 8.8, odude Crypto Tool)
- [CVE-2024-9988](https://cve.now/CVE-2024-9988.md): Crypto \<= 2.19 - Authentication Bypass via register (CVSS 9.8, odude Crypto Tool)
- [CVE-2024-10491](https://cve.now/CVE-2024-10491.md): Preload arbitrary resources by injecting additional \`Link\` headers (CVSS 4.0, express)
- [CVE-2024-8924](https://cve.now/CVE-2024-8924.md): Unauthenticated Blind SQL Injection in Core Platform (CVSS 8.7, ServiceNow Now Platform)
- [CVE-2024-8923](https://cve.now/CVE-2024-8923.md): Sandbox Escape in Now Platform (CVSS 9.3, ServiceNow Now Platform)
- [CVE-2024-25566](https://cve.now/CVE-2024-25566.md): Open Redirect in PingAM (CVSS 5.1, Ping Identity PingAM)
- [CVE-2024-7985](https://cve.now/CVE-2024-7985.md): FileOrganizer \<= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 7.5, softaculous FileOrganizer – WordPress File Manager)
- [CVE-2024-10452](https://cve.now/CVE-2024-10452.md): Organization admins can delete pending invites created in an organization they are not part of. (CVSS 2.2, Grafana · github.com/grafana/grafana)
- [CVE-2024-50334](https://cve.now/CVE-2024-50334.md): Semicolon Path Injection on API /api;/config (CVSS 8.7, Erudika scoold)
- [CVE-2024-49768](https://cve.now/CVE-2024-49768.md): Waitress has request processing race condition in HTTP pipelining with invalid first request (CVSS 9.1, Pylons waitress · waitress)
- [CVE-2024-49769](https://cve.now/CVE-2024-49769.md): Waitress has a denial of service leading to high CPU usage/resource exhaustion (CVSS 7.5, Pylons waitress · waitress)
- [CVE-2024-48921](https://cve.now/CVE-2024-48921.md): Kyverno's PolicyException objects can be created in any namespace by default (CVSS 8.7, kyverno · github.com/kyverno/kyverno)
- [CVE-2024-10226](https://cve.now/CVE-2024-10226.md): Arconix Shortcodes \<= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode (CVSS 6.4, tychesoftwares Arconix Shortcodes)
- [CVE-2024-9505](https://cve.now/CVE-2024-9505.md): Beaver Builder – WordPress Page Builder \<= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget (CVSS 6.4, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2024-47640](https://cve.now/CVE-2024-47640.md): WordPress WP ERP plugin \<= 1.13.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, weDevs WP ERP)
- [CVE-2024-49632](https://cve.now/CVE-2024-49632.md): WordPress CWD 3D Image Gallery plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Senthil Vel CWD 3D Image Gallery)
- [CVE-2024-49634](https://cve.now/CVE-2024-49634.md): WordPress BP Member Type Manager plugin \<= 1.01 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rimon Habib BP Member Type Manager)
- [CVE-2024-49635](https://cve.now/CVE-2024-49635.md): WordPress Banner Slider plugin \<= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, manjurul.cis Banner Slider)
- [CVE-2024-6673](https://cve.now/CVE-2024-6673.md): CSRF Vulnerability in parisneo/lollms-webui (CVSS 4.4, parisneo/lollms-webui)
- [CVE-2024-8309](https://cve.now/CVE-2024-8309.md): SQL Injection in langchain-ai/langchain (CVSS 4.9, langchain-ai/langchain · langchain-community +1)
- [CVE-2024-7042](https://cve.now/CVE-2024-7042.md): Prompt Injection in langchain-ai/langchainjs Leading to SQL Injection (CVSS 4.9, langchain-ai/langchainjs · @langchain/community)
- [CVE-2024-7472](https://cve.now/CVE-2024-7472.md): Email Injection Vulnerability in lunary-ai/lunary (CVSS 5.3, lunary-ai/lunary)
- [CVE-2024-49636](https://cve.now/CVE-2024-49636.md): WordPress Agile Video Player Lite plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, woracal Agile Video Player Lite)
- [CVE-2024-7783](https://cve.now/CVE-2024-7783.md): Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm (CVSS 5.9, mintplex-labs/anything-llm)
- [CVE-2024-7774](https://cve.now/CVE-2024-7774.md): Path Traversal in langchain-ai/langchainjs (CVSS 6.5, langchain-ai/langchainjs · langchain)
- [CVE-2024-8143](https://cve.now/CVE-2024-8143.md): Unauthorized Access to User Chat History in gaizhenbiao/chuanhuchatgpt (CVSS 6.5, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2024-6581](https://cve.now/CVE-2024-6581.md): Remote Code Execution due to Stored XSS in parisneo/lollms (CVSS 6.5, parisneo/lollms · lollms)
- [CVE-2024-5823](https://cve.now/CVE-2024-5823.md): File Overwrite Vulnerability in gaizhenbiao/chuanhuchatgpt (CVSS 6.5, gaizhenbiao/chuanhuchatgpt)
- [CVE-2024-7473](https://cve.now/CVE-2024-7473.md): IDOR Vulnerability in lunary-ai/lunary (CVSS 7.5, lunary-ai/lunary)
- [CVE-2024-7010](https://cve.now/CVE-2024-7010.md): Timing Attack in mudler/localai (CVSS 7.5, mudler/localai)
- [CVE-2024-7807](https://cve.now/CVE-2024-7807.md): Denial of Service (DOS) in gaizhenbiao/chuanhuchatgpt (CVSS 7.5, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2024-49637](https://cve.now/CVE-2024-49637.md): WordPress Bet WC 2018 Russia plugin \<= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Foxskav Bet WC 2018 Russia)
- [CVE-2024-7962](https://cve.now/CVE-2024-7962.md): Arbitrary File Read via Insufficient Validation in gaizhenbiao/chuanhuchatgpt (CVSS 7.5, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2024-6868](https://cve.now/CVE-2024-6868.md): Arbitrary File Write in mudler/LocalAI (CVSS 8.1, mudler/localai)
- [CVE-2024-6674](https://cve.now/CVE-2024-6674.md): Data Leak through CORS Misconfiguration in parisneo/lollms-webui (CVSS 8.1, parisneo/lollms-webui)
- [CVE-2024-7474](https://cve.now/CVE-2024-7474.md): IDOR in lunary-ai/lunary (CVSS 9.1, lunary-ai/lunary)
- [CVE-2024-5982](https://cve.now/CVE-2024-5982.md): Path Traversal in gaizhenbiao/chuanhuchatgpt (CVSS 9.1, gaizhenbiao/chuanhuchatgpt)
- [CVE-2024-7475](https://cve.now/CVE-2024-7475.md): Improper Access Control in lunary-ai/lunary (CVSS 9.1, lunary-ai/lunary)
- [CVE-2024-41156](https://cve.now/CVE-2024-41156.md): Profile files from TRO600 series radios are extracted in plain-text and encrypted file formats. (CVSS 2.7, Hitachi Energy TRO600)
- [CVE-2024-49638](https://cve.now/CVE-2024-49638.md): WordPress Risk Warning Bar plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ventureharbour Risk Warning Bar)
- [CVE-2024-49639](https://cve.now/CVE-2024-49639.md): WordPress Monitor.chat plugin \<= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Edward Stoever Monitor.chat)
- [CVE-2024-49640](https://cve.now/CVE-2024-49640.md): WordPress ACL Floating Cart for WooCommerce plugin \<= 0.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AmaderCode Lab ACL Floating Cart for WooCommerce)
- [CVE-2024-41153](https://cve.now/CVE-2024-41153.md): Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system comm (CVSS 7.2, Hitachi Energy TRO600)
- [CVE-2024-49641](https://cve.now/CVE-2024-49641.md): WordPress Tida URL Screenshot plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tidaweb Tida URL Screenshot)
- [CVE-2024-10474](https://cve.now/CVE-2024-10474.md): Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circum (CVSS 9.1, Mozilla Focus for iOS)
- [CVE-2024-10468](https://cve.now/CVE-2024-10468.md): Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash. (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-10467](https://cve.now/CVE-2024-10467.md): Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-10466](https://cve.now/CVE-2024-10466.md): By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-10465](https://cve.now/CVE-2024-10465.md): A clipboard "paste" button could persist across tabs which allowed a spoofing attack. (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-10464](https://cve.now/CVE-2024-10464.md): Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser. (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-10463](https://cve.now/CVE-2024-10463.md): Video frames could have been leaked between origins in some situations. (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-10462](https://cve.now/CVE-2024-10462.md): Truncation of a long URL could have allowed origin spoofing in a permission prompt. (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-10461](https://cve.now/CVE-2024-10461.md): In multipart/x-mixed-replace responses, \`Content-Disposition: attachment\` in the response header was not respected and did not force a downl (CVSS 6.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-10460](https://cve.now/CVE-2024-10460.md): The origin of an external protocol handler prompt could have been obscured using a data: URL within an \`iframe\`. (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-10459](https://cve.now/CVE-2024-10459.md): An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-10458](https://cve.now/CVE-2024-10458.md): A permission leak could have occurred from a trusted site to an untrusted site via \`embed\` or \`object\` elements. (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-49643](https://cve.now/CVE-2024-49643.md): WordPress Whitelist plugin \<= 3.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fifthsegment Whitelist)
- [CVE-2024-49645](https://cve.now/CVE-2024-49645.md): WordPress Affiliate Platform plugin \<= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ilias Gomatos Affiliate Platform)
- [CVE-2024-49646](https://cve.now/CVE-2024-49646.md): WordPress Code Generate plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ioannup Code Generate)
- [CVE-2024-49647](https://cve.now/CVE-2024-49647.md): WordPress Simple Custom Admin plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Carl Alberto Simple Custom Admin)
- [CVE-2024-49648](https://cve.now/CVE-2024-49648.md): WordPress SVG Captcha plugin \<= 1.0.11 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, rafasashi SVG Captcha)
- [CVE-2024-49650](https://cve.now/CVE-2024-49650.md): WordPress BuddyPress Greeting Message plugin \<= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Xarbo BuddyPress Greeting Message)
- [CVE-2017-20195](https://cve.now/CVE-2017-20195.md): LUNAD3v AreaLoad request.php sql injection (CVSS 5.1, LUNAD3v AreaLoad)
- [CVE-2024-49651](https://cve.now/CVE-2024-49651.md): WordPress WooCommerce Maintenance Mode plugin \<= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Matt Royal WooCommerce Maintenance Mode)
- [CVE-2024-49654](https://cve.now/CVE-2024-49654.md): WordPress Extra Privacy for Elementor plugin \<= 0.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Marian Heddesheimer Extra Privacy for Elementor)
- [CVE-2024-49656](https://cve.now/CVE-2024-49656.md): WordPress DocumentPress plugin \<= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fifthsegment DocumentPress)
- [CVE-2024-49659](https://cve.now/CVE-2024-49659.md): WordPress Coub plugin \<= 1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Coub)
- [CVE-2024-49660](https://cve.now/CVE-2024-49660.md): WordPress Campus Explorer Widget plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CampusExplorer Campus Explorer Widget)
- [CVE-2024-49661](https://cve.now/CVE-2024-49661.md): WordPress leenk.me plugin \<= 2.16.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Lew Ayotte leenk.me)
- [CVE-2024-49662](https://cve.now/CVE-2024-49662.md): WordPress Simple Load More plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Webgensis Simple Load More)
- [CVE-2024-49663](https://cve.now/CVE-2024-49663.md): WordPress uCAT – Next Story plugin \<= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, elenkadark uCAT – Next Story)
- [CVE-2024-10181](https://cve.now/CVE-2024-10181.md): Newsletters \<= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters\_video Shortcode (CVSS 6.4, contrid Newsletters)
- [CVE-2024-49664](https://cve.now/CVE-2024-49664.md): WordPress chatplusjp plugin \<= 1.02 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, chatplusjp)
- [CVE-2024-49665](https://cve.now/CVE-2024-49665.md): WordPress Web Bricks Addons for Elementor plugin \<= 1.1.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Web Bricks Addons for Elementor)
- [CVE-2024-49667](https://cve.now/CVE-2024-49667.md): WordPress Local Business Addons For Elementor plugin \<= 1.1.5 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Asaduzzaman Abir Local Business Addons For Elementor)
- [CVE-2024-49670](https://cve.now/CVE-2024-49670.md): WordPress Client Power Tools Portal plugin \<= 1.9.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sam Glover Client Power Tools Portal)
- [CVE-2024-49672](https://cve.now/CVE-2024-49672.md): WordPress Google Docs RSVP plugin \<= 2.0.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, giffordcheung Google Docs RSVP)
- [CVE-2024-49673](https://cve.now/CVE-2024-49673.md): WordPress LaTeX2HTML plugin \<= 2.5.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Van Abel LaTeX2HTML)
- [CVE-2024-49678](https://cve.now/CVE-2024-49678.md): WordPress js paper theme \<= 2.5.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jinwen js paper)
- [CVE-2024-10360](https://cve.now/CVE-2024-10360.md): Move Addons for Elementor \<= 1.3.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates (CVSS 4.3, moveaddons Move Addons for Elementor)
- [CVE-2024-10233](https://cve.now/CVE-2024-10233.md): SMSAlert - WooCommerce \<= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa\_subscribe Shortcode (CVSS 6.4, cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…)
- [CVE-2024-10266](https://cve.now/CVE-2024-10266.md): Premium Addons for Elementor \<= 4.10.60 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Box Widget (CVSS 6.4, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2024-10185](https://cve.now/CVE-2024-10185.md): StreamWeasels YouTube Integration \<= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-youtube-embed Shortcode (CVSS 6.4, StreamWeasels YouTube Integration)
- [CVE-2024-10184](https://cve.now/CVE-2024-10184.md): SW Kick Integration - Blocks and Shortcodes for Embedding Kick Streams \<= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-kick-embed Shortcode (CVSS 6.4, StreamWeasels Kick Integration)
- [CVE-2024-49679](https://cve.now/CVE-2024-49679.md): WordPress WPKoi Templates for Elementor plugin \<= 3.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, wpkoithemes WPKoi Templates for Elementor)
- [CVE-2024-49692](https://cve.now/CVE-2024-49692.md): WordPress AffiliateX plugin \<= 1.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPCenter AffiliateX)
- [CVE-2024-50407](https://cve.now/CVE-2024-50407.md): WordPress Namaste! LMS plugin \<= 2.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bob Namaste! LMS)
- [CVE-2024-50409](https://cve.now/CVE-2024-50409.md): WordPress Namaste! LMS plugin \<= 2.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Bob Namaste! LMS)
- [CVE-2024-50410](https://cve.now/CVE-2024-50410.md): WordPress Namaste! LMS plugin \<= 2.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Bob Namaste! LMS)
- [CVE-2024-50550](https://cve.now/CVE-2024-50550.md): WordPress LiteSpeed Cache plugin \<= 6.5.1 - Privilege Escalation vulnerability (CVSS 8.1, LiteSpeed Technologies LiteSpeed Cache)
- [CVE-2024-10227](https://cve.now/CVE-2024-10227.md): affiliate-toolkit \<= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp\_product Shortcode (CVSS 6.4, cservit affiliate-toolkit – Multi-Network Affiliate & Amazo…)
- [CVE-2024-10437](https://cve.now/CVE-2024-10437.md): WPC Smart Messages for WooCommerce \<= 4.2.1 - Missing Authorization to Authenticated (Subscriber+) Message Activation/Deactivation (CVSS 4.3, wpclever WPC Smart Messages for WooCommerce)
- [CVE-2024-10436](https://cve.now/CVE-2024-10436.md): WPC Smart Messages for WooCommerce \<= 4.2.1 - Authenticated (Subscriber+) Local File Inclusion (CVSS 8.8, wpclever WPC Smart Messages for WooCommerce)
- [CVE-2024-9376](https://cve.now/CVE-2024-9376.md): Kata Plus – Addons for Elementor – Widgets, Extensions and Templates \<= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, climaxthemes Kata Plus – Addons for Elementor – Widgets, Ex…)
- [CVE-2024-22066](https://cve.now/CVE-2024-22066.md): There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router . (CVSS 7.5, ZTE ZXR10 1800-2S)
- [CVE-2024-45477](https://cve.now/CVE-2024-45477.md): Apache NiFi: Improper Neutralization of Input in Parameter Description (CVSS 4.6, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2024-49642](https://cve.now/CVE-2024-49642.md): WordPress Todo Custom Field plugin \<= 3.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, rafasashi Todo Custom Field)
- [CVE-2024-50411](https://cve.now/CVE-2024-50411.md): WordPress WP Abstracts plugin \<= 2.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Kevon Adonis WP Abstracts)
- [CVE-2024-50412](https://cve.now/CVE-2024-50412.md): WordPress Conditional Fields for Contact Form 7 plugin \<= 2.4.15 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Jules Colle Conditional Fields for Contact Form)
- [CVE-2024-50413](https://cve.now/CVE-2024-50413.md): WordPress Import and export users and customers plugin \<= 1.27.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Javier Carazo Import and export users and customers)
- [CVE-2024-50414](https://cve.now/CVE-2024-50414.md): WordPress Button contact VR plugin \<= 4.7.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Buttonizer Button contact VR)
- [CVE-2024-50415](https://cve.now/CVE-2024-50415.md): WordPress Ads.txt & App-ads.txt Manager for WordPress plugin \<= 1.1.7.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Pagup Ads.txt & App-ads.txt Manager for WordPress)
- [CVE-2024-50418](https://cve.now/CVE-2024-50418.md): WordPress Time Slot plugin \<= 1.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Time Slot Booking Time Slot)
- [CVE-2024-50426](https://cve.now/CVE-2024-50426.md): WordPress Survey Maker plugin \<= 5.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Ays Pro Survey Maker)
- [CVE-2024-50475](https://cve.now/CVE-2024-50475.md): WordPress Signup Page plugin \<= 1.0 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 9.8, Scott Gamon Signup Page)
- [CVE-2024-50476](https://cve.now/CVE-2024-50476.md): WordPress GRÜN spendino Spendenformular plugin \<= 1.0.1 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 9.8, GRÜN Software Group GRÜN spendino Spendenformular)
- [CVE-2024-50481](https://cve.now/CVE-2024-50481.md): WordPress Bstone Demo Importer plugin \<= 1.0.1 - Privilege Escalation vulnerability (CVSS 8.8, stackthemes Bstone Demo Importer)
- [CVE-2024-50485](https://cve.now/CVE-2024-50485.md): WordPress Exam Matrix plugin \<= 1.5 - Privilege Escalation vulnerability (CVSS 9.8, Udit Rawat Exam Matrix)
- [CVE-2024-50490](https://cve.now/CVE-2024-50490.md): WordPress PegaPoll plugin \<= 1.0.2 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 9.8, lowcage PegaPoll)
- [CVE-2024-50420](https://cve.now/CVE-2024-50420.md): WordPress aDirectory plugin \<= 1.3 - Arbitrary File Upload vulnerability (CVSS 10.0, aDirectory)
- [CVE-2024-50427](https://cve.now/CVE-2024-50427.md): WordPress SurveyJS plugin \<= 1.9.136 - Arbitrary File Upload vulnerability (CVSS 9.9, devsoftbaltic SurveyJS)
- [CVE-2024-10048](https://cve.now/CVE-2024-10048.md): Post Status Notifier Lite and Premium \<= 1.11.6 - Reflected Cross-Site Scripting via page (CVSS 6.1, ifeelweb Post Status Notifier · worschtebrot Post Status No…)
- [CVE-2024-9438](https://cve.now/CVE-2024-9438.md): SEUR Oficial \<= 2.2.11 - Reflected Cross-Site Scripting (CVSS 6.1, seuroficial SEUR Oficial)
- [CVE-2024-50473](https://cve.now/CVE-2024-50473.md): WordPress Ajar in5 Embed plugin \<= 3.1.3 - Arbitrary File Upload vulnerability (CVSS 10.0, Ajar Productions Ajar in5 Embed)
- [CVE-2024-46872](https://cve.now/CVE-2024-46872.md): Client-Side Path Traversal Leading to CSRF in Playbooks (CVSS 4.6, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-47401](https://cve.now/CVE-2024-47401.md): DoS via Amplified GraphQL Response in Playbooks (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2024-50052](https://cve.now/CVE-2024-50052.md): Arbitrary post deletion via Playbooks /ignore-thread endpoint (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2024-10241](https://cve.now/CVE-2024-10241.md): Private channel names leaked with Ctrl+K when ElasticSearch is enabled (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-50480](https://cve.now/CVE-2024-50480.md): WordPress Marketing Automation by AZEXO plugin \<= 1.27.80 - Arbitrary File Upload vulnerability (CVSS 9.9, Marketing Automation by AZEXO)
- [CVE-2024-50482](https://cve.now/CVE-2024-50482.md): WordPress Woocommerce Product Design plugin \<= 1.0.0 - Arbitrary File Upload vulnerability (CVSS 10.0, Chetan Khandla Woocommerce Product Design)
- [CVE-2024-50484](https://cve.now/CVE-2024-50484.md): WordPress Multi Purpose Mail Form plugin \<= 1.0.2 - Arbitrary File Upload vulnerability (CVSS 10.0, Lindeni Mahlalela Multi Purpose Mail Form)
- [CVE-2024-50493](https://cve.now/CVE-2024-50493.md): WordPress Automatic Translation plugin \<= 1.0.4 - Arbitrary File Upload vulnerability (CVSS 10.0, masterhomepage Automatic Translation)
- [CVE-2024-50494](https://cve.now/CVE-2024-50494.md): WordPress Sudan Payment Gateway for WooCommerce plugin \<= 1.2.2 - Arbitrary File Upload vulnerability (CVSS 10.0, Amin Omer Sudan Payment Gateway for WooCommerce)
- [CVE-2024-10312](https://cve.now/CVE-2024-10312.md): Exclusive Addons for Elementor \<= 2.7.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates (CVSS 4.3, timstrifler Exclusive Addons for Elementor)
- [CVE-2024-10000](https://cve.now/CVE-2024-10000.md): Masteriyo LMS – eLearning and Online Course Builder for WordPress \<= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functionality (CVSS 6.4, Masteriyo LMS – Online Course Builder for eLearning, LMS &…)
- [CVE-2024-10008](https://cve.now/CVE-2024-10008.md): Masteriyo LMS – eLearning and Online Course Builder for WordPress \<= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege Escalation (CVSS 8.8, Masteriyo LMS – Online Course Builder for eLearning, LMS &…)
- [CVE-2024-22065](https://cve.now/CVE-2024-22065.md): ZTE MF258 Pro product has a OS Command injection vulnerability (CVSS 6.8, ZTE MF258 Pro)
- [CVE-2024-10479](https://cve.now/CVE-2024-10479.md): LinZhaoguan pb-cms Theme Management Module admin#themes cross site scripting (CVSS 5.1, LinZhaoguan pb-cms)
- [CVE-2024-50088](https://cve.now/CVE-2024-50088.md): btrfs: fix uninitialized pointer free in add\_inode\_ref() (CVSS 7.8, Linux)
- [CVE-2024-50087](https://cve.now/CVE-2024-50087.md): btrfs: fix uninitialized pointer free on read\_alloc\_one\_name() error (CVSS 7.8, Linux)
- [CVE-2024-50086](https://cve.now/CVE-2024-50086.md): ksmbd: fix user-after-free from session log off (CVSS 9.8, Linux)
- [CVE-2024-50085](https://cve.now/CVE-2024-50085.md): mptcp: pm: fix UaF read in mptcp\_pm\_nl\_rm\_addr\_or\_subflow (CVSS 9.8, Linux)
- [CVE-2024-50084](https://cve.now/CVE-2024-50084.md): net: microchip: vcap api: Fix memory leaks in vcap\_api\_encode\_rule\_test() (CVSS 7.8, Linux)
- [CVE-2024-50083](https://cve.now/CVE-2024-50083.md): tcp: fix mptcp DSS corruption due to large pmtu xmit (no CVSS, Linux)
- [CVE-2024-50082](https://cve.now/CVE-2024-50082.md): blk-rq-qos: fix crash on rq\_qos\_wait vs. rq\_qos\_wake\_function race (CVSS 7.8, Linux)
- [CVE-2024-50081](https://cve.now/CVE-2024-50081.md): blk-mq: setup queue -\>tag\_set before initializing hctx (CVSS 5.5, Linux)
- [CVE-2024-50080](https://cve.now/CVE-2024-50080.md): ublk: don't allow user copy for unprivileged device (CVSS 5.5, Linux)
- [CVE-2024-50079](https://cve.now/CVE-2024-50079.md): io\_uring/sqpoll: ensure task state is TASK\_RUNNING when running task\_work (CVSS 5.5, Linux)
- [CVE-2024-50078](https://cve.now/CVE-2024-50078.md): Bluetooth: Call iso\_exit() on module unload (CVSS 7.8, Linux)
- [CVE-2024-50077](https://cve.now/CVE-2024-50077.md): Bluetooth: ISO: Fix multiple init when debugfs is disabled (CVSS 7.8, Linux)
- [CVE-2024-50076](https://cve.now/CVE-2024-50076.md): vt: prevent kernel-infoleak in con\_font\_get() (no CVSS, Linux)
- [CVE-2024-50075](https://cve.now/CVE-2024-50075.md): xhci: tegra: fix checked USB2 port number (CVSS 8.0, Linux)
- [CVE-2024-50074](https://cve.now/CVE-2024-50074.md): parport: Proper fix for array out-of-bounds access (CVSS 7.8, Linux)
- [CVE-2024-50073](https://cve.now/CVE-2024-50073.md): tty: n\_gsm: Fix use-after-free in gsm\_cleanup\_mux (CVSS 7.8, Linux)
- [CVE-2024-50072](https://cve.now/CVE-2024-50072.md): x86/bugs: Use code segment selector for VERW operand (no CVSS, Linux)
- [CVE-2024-50071](https://cve.now/CVE-2024-50071.md): pinctrl: nuvoton: fix a double free in ma35\_pinctrl\_dt\_node\_to\_map\_func() (CVSS 7.8, Linux)
- [CVE-2024-50070](https://cve.now/CVE-2024-50070.md): pinctrl: stm32: check devm\_kasprintf() returned value (no CVSS, Linux)
- [CVE-2024-50069](https://cve.now/CVE-2024-50069.md): pinctrl: apple: check devm\_kasprintf() returned value (CVSS 5.5, Linux)
- [CVE-2024-50068](https://cve.now/CVE-2024-50068.md): mm/damon/tests/sysfs-kunit.h: fix memory leak in damon\_sysfs\_test\_add\_targets() (CVSS 5.5, Linux)
- [CVE-2024-45656](https://cve.now/CVE-2024-45656.md): IBM Flexible Service Processor hard coded credentials (CVSS 9.8, IBM Flexible Service Processor)
- [CVE-2024-10478](https://cve.now/CVE-2024-10478.md): LinZhaoguan pb-cms Edit Article edit cross site scripting (CVSS 5.1, LinZhaoguan pb-cms)
- [CVE-2024-10477](https://cve.now/CVE-2024-10477.md): LinZhaoguan pb-cms Permission Management Page admin#permissions cross site scripting (CVSS 5.1, LinZhaoguan pb-cms)
- [CVE-2019-25219](https://cve.now/CVE-2019-25219.md): Asio C++ Library before 1.13.0 lacks a fallback error code in the case of SSL\_ERROR\_SYSCALL with no associated error information from the SS (CVSS 7.5)
- [CVE-2024-44080](https://cve.now/CVE-2024-44080.md): In Jitsi Meet before 2.0.9779, the functionality to share an image using giphy was implemented in an insecure way, resulting in clients load (CVSS 7.5)
- [CVE-2024-44081](https://cve.now/CVE-2024-44081.md): In Jitsi Meet before 2.0.9779, the functionality to share a video file was implemented in an insecure way, resulting in clients loading vide (CVSS 9.8)
- [CVE-2024-48063](https://cve.now/CVE-2024-48063.md): In PyTorch \<=2.4.1, the RemoteModule has Deserialization RCE. (no CVSS, torch)
- [CVE-2024-48138](https://cve.now/CVE-2024-48138.md): A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres\_edittpl.php of PluXml v5.8.16 and lower allows at (CVSS 9.8)
- [CVE-2024-48206](https://cve.now/CVE-2024-48206.md): A Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of arbitrary code. (CVSS 9.8)
- [CVE-2024-48461](https://cve.now/CVE-2024-48461.md): Cross Site Scripting vulnerability in TeslaLogger Admin Panel before v.1.59.6 allows a remote attacker to execute arbitrary code via the New (CVSS 4.8)
- [CVE-2024-48572](https://cve.now/CVE-2024-48572.md): A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a u (CVSS 5.3)
- [CVE-2024-48573](https://cve.now/CVE-2024-48573.md): A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account pas (CVSS 9.8)
- [CVE-2024-48955](https://cve.now/CVE-2024-48955.md): Broken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the functionalities menus, the (CVSS 8.1)
- [CVE-2024-51075](https://cve.now/CVE-2024-51075.md): A Reflected Cross Site Scripting (XSS) vulnerability was found in /odms/admin/user-search.php in PHPGurukul Online DJ Booking Management Sys (CVSS 6.1)
- [CVE-2024-51076](https://cve.now/CVE-2024-51076.md): A Reflected Cross Site Scripting (XSS) vulnerability was found in /odms/admin/booking-search.php in PHPGurukul Online DJ Booking Management (CVSS 6.1)
- [CVE-2024-51180](https://cve.now/CVE-2024-51180.md): A Reflected Cross Site Scripting (XSS) vulnerability was found in /ifscfinder/index.php in PHPGurukul IFSC Code Finder Project v1.0, which a (CVSS 8.8)
- [CVE-2024-51181](https://cve.now/CVE-2024-51181.md): A Reflected Cross Site Scripting (XSS) vulnerability was found in /ifscfinder/admin/profile.php in PHPGurukul IFSC Code Finder Project v1.0, (CVSS 8.8)
- [CVE-2024-51378](https://cve.now/CVE-2024-51378.md): getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authenticat (CVSS 10.0, KEV)
- [CVE-2024-51567](https://cve.now/CVE-2024-51567.md): upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and (CVSS 10.0, KEV)
- [CVE-2024-51568](https://cve.now/CVE-2024-51568.md): CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. (CVSS 10.0)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.